{
  "uuid": "6bd4f56c-0f87-4a6f-96d1-65cdb5748f9b",
  "domain": "mail.signin-icloud.sa.com",
  "algorithm_version": "corr-1.2.0",
  "generated_at": "2026-08-11T05:00:27.561793+00:00",
  "cluster": {
    "id": 290,
    "key": "a1e6fc257403",
    "size": 4,
    "url": "https://phishunt.io/campaigns/a1e6fc257403/"
  },
  "count": 4,
  "limit": 10,
  "results": [
    {
      "uuid": "b9a97a11-926a-4078-94b6-c4a2ce9d7aab",
      "domain": "signin-icloud.sa.com",
      "url": "http://signin-icloud.sa.com/fl26",
      "company": "apple",
      "status": "active",
      "first_seen": "2026-08-11 01:01:38.806570+00:00",
      "relationship_score": 64,
      "evidence": [
        {
          "type": "ocr_similarity_full",
          "value": "jaccard=1.00",
          "contributed": 6.0
        },
        {
          "type": "apex_subdomain_overlap",
          "value": "sa.com",
          "contributed": 6.2
        },
        {
          "type": "same_asn",
          "value": "31898",
          "contributed": 0.0
        },
        {
          "type": "same_ip",
          "value": "108.167.146.200",
          "contributed": 10.9
        },
        {
          "type": "same_ns_set",
          "value": "ns1.centralnic.net,ns2.centralnic.net,ns3.centralnic.net,ns4.centralnic.net",
          "contributed": 6.9
        },
        {
          "type": "same_org",
          "value": "Oracle Corporation",
          "contributed": 0.0
        },
        {
          "type": "shared_final_host",
          "value": "www.icloud.com",
          "contributed": 6.0
        },
        {
          "type": "shared_distinctive_token",
          "value": "icloud",
          "contributed": 5.0
        },
        {
          "type": "same_registrar",
          "value": "Sav.com, LLC",
          "contributed": 4
        },
        {
          "type": "temporal_24h",
          "value": "0.0h",
          "contributed": 6
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        },
        {
          "type": "screenshot_phash_full",
          "value": "f777888f8c203399~f777888f8c203399 d=0",
          "contributed": 12.8
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/apple/b9a97a11-926a-4078-94b6-c4a2ce9d7aab/"
    },
    {
      "uuid": "9dae0dc2-567e-4ab7-a857-78d0cb170ee3",
      "domain": "icloudfind.live",
      "url": "http://icloudfind.live/fl26",
      "company": "apple",
      "status": "active",
      "first_seen": "2026-08-11 01:01:17.658787+00:00",
      "relationship_score": 52,
      "evidence": [
        {
          "type": "ocr_similarity_full",
          "value": "jaccard=1.00",
          "contributed": 6.0
        },
        {
          "type": "same_asn",
          "value": "31898",
          "contributed": 0.0
        },
        {
          "type": "same_ip",
          "value": "108.167.146.200",
          "contributed": 17.6
        },
        {
          "type": "same_org",
          "value": "Oracle Corporation",
          "contributed": 0.0
        },
        {
          "type": "shared_final_host",
          "value": "www.icloud.com",
          "contributed": 9.6
        },
        {
          "type": "temporal_24h",
          "value": "0.0h",
          "contributed": 6
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        },
        {
          "type": "screenshot_phash_full",
          "value": "f777888f8c203399~f777888f8c203399 d=0",
          "contributed": 12.8
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/apple/9dae0dc2-567e-4ab7-a857-78d0cb170ee3/"
    },
    {
      "uuid": "e883b210-6d5e-4bed-a3cc-c7836fc59f56",
      "domain": "mail.icloudfind.live",
      "url": "https://mail.icloudfind.live/fl26",
      "company": "apple",
      "status": "active",
      "first_seen": "2026-08-11 01:01:12.274646+00:00",
      "relationship_score": 52,
      "evidence": [
        {
          "type": "ocr_similarity_full",
          "value": "jaccard=1.00",
          "contributed": 6.0
        },
        {
          "type": "same_asn",
          "value": "31898",
          "contributed": 0.0
        },
        {
          "type": "same_ip",
          "value": "108.167.146.200",
          "contributed": 17.6
        },
        {
          "type": "same_org",
          "value": "Oracle Corporation",
          "contributed": 0.0
        },
        {
          "type": "shared_final_host",
          "value": "www.icloud.com",
          "contributed": 9.6
        },
        {
          "type": "temporal_24h",
          "value": "0.0h",
          "contributed": 6
        },
        {
          "type": "dominant_colors_match",
          "value": "dist=0.0",
          "contributed": 0.0
        },
        {
          "type": "screenshot_phash_full",
          "value": "f777888f8c203399~f777888f8c203399 d=0",
          "contributed": 12.8
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/apple/e883b210-6d5e-4bed-a3cc-c7836fc59f56/"
    },
    {
      "uuid": "3903b5ce-15fc-4265-8673-cfd37c11db8a",
      "domain": "393bet-facebook.sa.com",
      "url": "https://393bet-facebook.sa.com",
      "company": "facebook",
      "status": "active",
      "first_seen": "2026-06-16 08:30:25.612287+00:00",
      "relationship_score": 25,
      "evidence": [
        {
          "type": "apex_subdomain_overlap",
          "value": "sa.com",
          "contributed": 10.0
        },
        {
          "type": "same_ns_set",
          "value": "ns1.centralnic.net,ns2.centralnic.net,ns3.centralnic.net,ns4.centralnic.net",
          "contributed": 11.2
        },
        {
          "type": "same_registrar",
          "value": "Sav.com, LLC",
          "contributed": 4
        }
      ],
      "detail_url": "https://phishunt.io/suspicious/facebook/3903b5ce-15fc-4265-8673-cfd37c11db8a/"
    }
  ]
}